kind
Renders kind (Kubernetes IN Docker) cluster configuration files from inventory parameters, with digest-pinned node images by Kubernetes version.
- Latest
- 1.0.0 ·
- License
- Apache-2.0
- Owners
- Moep90
- Source
- github.com/kadet-hub/generators · 0 repo stars, shared by 35 generators
- Thumbs up
- 👍 0 on GitHub Discussions
- Popularity
- 16 · 222 pulls
Request a feature Report a problem
Badge
Show the latest listed version in your README. shields.io draws the badge from this page's badge.json, which every catalog build updates; once no version is listed, it reads "not listed".
[](https://kadet-hub.org/generators/kind/)
kind Generator
Published on kadet-hub: pin a released version by digest from its catalog page.
Kapitan kadet generator for kind cluster configuration files (kind.x-k8s.io/v1alpha4 Cluster). Each entry under clusters renders one file for kind create cluster --config.
Built for kind v0.33.0.
Usage
parameters:
kapitan:
dependencies:
- type: oci
source: ghcr.io/kadet-hub/kind@sha256:<digest>
output_path: lib/kind
compile:
- output_path: kind/
input_type: kadet
output_type: yaml
input_paths:
- lib/kind
generators:
kind:
clusters:
dev:
kubernetes_version: "1.37"
networking:
disable_default_cni: true
pod_subnet: 192.168.0.0/16
nodes:
- role: control-plane
extra_port_mappings:
- container_port: 30080
host_port: 8080
listen_address: 127.0.0.1
- role: worker
labels:
tier: frontend
- role: worker
labels:
tier: backendkind create cluster --config compiled/<target>/kind/dev.yamlInputs
All keys live under parameters.generators.kind.clusters.<name>. Keys are snake_case and render the kind camelCase field of the same name; values pass through unchanged. The camelCase spelling of a modelled key raises an error naming the replacement; any other unknown key is dropped with a warning.
| Level | Keys |
|---|---|
| cluster | kubernetes_version, feature_gates, runtime_config, networking, nodes, containerd_config_patches, containerd_config_patches_json6902, spec |
networking |
ip_family, api_server_address, api_server_port, pod_subnet, service_subnet, disable_default_cni, kube_proxy_mode |
nodes[] |
role, image, kubernetes_version, labels, extra_mounts, extra_port_mappings, kubeadm_config_patches, kubeadm_config_patches_json6902 |
extra_mounts[] |
host_path, container_path, read_only, selinux_relabel, propagation |
extra_port_mappings[] |
container_port, host_port, listen_address, protocol |
ip_family, kube_proxy_mode, role, propagation and protocol are checked against the values kind accepts. containerd_config_patches_json6902 is a list of strings, as in kind.
kubernetes_version ("1.37", "1.37.0" or "v1.37.0"; quote it) sets image to the digest-pinned kindest/node image that the kind v0.33.0 release notes list for that version: 1.37.0, 1.36.4, 1.35.8 or 1.34.11. kind requires the @sha256 digest to get an image built for the release. Set on the cluster, it applies to every node without its own image or kubernetes_version; with no nodes, it writes out kind’s default single control-plane node. A node with both image and kubernetes_version is an error. Without kubernetes_version and image, kind uses its own default image.
spec holds kind fields in their upstream camelCase spelling, for fields without a flat key such as cluster-level kubeadmConfigPatches or networking.dnsSearch. It is written first and passes through unchecked; flat keys are applied on top, and a flat key that overrides a spec value logs a warning. kubernetes_version does not touch nodes given in spec.
The generator sets no defaults of its own. api_server_address stays kind’s 127.0.0.1 unless set; kind’s documentation strongly discourages exposing the API server on other addresses.
extra_mounts write hostPath entries, so the manifest declares the host-path output capability.
Output
| Input | Output file |
|---|---|
clusters.<name> |
<name>.yaml, with name: <name> |
The output is not schema-checked: kind publishes no JSON Schema for its config, so the generator ships none. kind itself decodes the file strictly and rejects unknown fields when the cluster is created.
Versions
Add a version's inventory entry, then compile with the consumer workflow, which verifies the artifact and runs Kapitan in the sandbox.
Free of charge, as is and on a best-effort basis: use at your own risk, and review the compiled output before you apply it. Terms
This catalog was built from index serial 47. Set index_serial: 47 in .kapitan-sandbox.yaml and the consumer workflow refuses any older index, so a rolled-back index cannot bring back a yanked version.
Checks find known patterns; they do not prove a generator safe. What a listing covers
| Version | Built for (schema-checked) |
|---|---|
| 1.0.0 | not recorded |
1.0.0#
Inventory
parameters:
kapitan:
dependencies:
- type: oci
source: ghcr.io/kadet-hub/kind:1.0.0@sha256:1df95b78070de07552a492c0da17f7658cdec54303b5adcd53d96274ac0aa05f
output_path: lib/kind
Verify
gh attestation verify \
oci://ghcr.io/kadet-hub/kind@sha256:1df95b78070de07552a492c0da17f7658cdec54303b5adcd53d96274ac0aa05f \
--owner kadet-hub \
--cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main
Transparency log: Rekor entry 3220554487, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.
- Kapitan declared
- >=0.36.3,<0.37
- Kapitan checked
- 0.36.3
- Backends checked
- not recorded
- With --cache
- not recorded
- krab
- compatible
- Built for (schema-checked)
- not recorded
- Source
- kind-v1.0.0 ·
313f1ca5e57679c11b891880f2cf10687832e4fc· kind - Binaries
- none
- Output capabilities
- host-path
- Digest
sha256:1df95b78070de07552a492c0da17f7658cdec54303b5adcd53d96274ac0aa05f
Checks
Checked by the release run on , gate at e79f456106a6.
- Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules. - Malware ClamAV 1.5.4
No file matched a ClamAV signature. - Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched. - Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls. - Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only). - File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist. - Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read. - Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares. - CI detection Kapitan 0.36.3
The output is the same with CI variables set.
Output diff
No output diff recorded: this version was published before the release run recorded one.